<div dir="ltr"><div>Here is a wired one - I was so sure the cert in SP did not match value in IdP's metadata - but even after the SP regenerated a new one, and I imported to the IdP's metadata the same occurs.<br><br></div>Any ideas? Thanks.<br><div><br>16:54:59.897 - DEBUG [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:125] - Attempting to validate SAML protocol message simple signature using context issuer: <a href="https://sp.foobar.edu/shibboleth-sp">https://sp.foobar.edu/shibboleth-sp</a><br>16:54:59.898 - DEBUG [org.opensaml.security.MetadataCredentialResolver:157] - Forcing on-demand metadata provider refresh if necessary<br>16:54:59.898 - DEBUG [org.opensaml.security.MetadataCredentialResolver:205] - Attempting to retrieve credentials from cache using index: [<a href="https://sp.foobar.edu/shibboleth-sp,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,SIGNING">https://sp.foobar.edu/shibboleth-sp,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,SIGNING</a>]<br>16:54:59.898 - DEBUG [org.opensaml.security.MetadataCredentialResolver:213] - Retrieved credentials from cache using index: [<a href="https://sp.foobar.edu/shibboleth-sp,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,SIGNING">https://sp.foobar.edu/shibboleth-sp,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,SIGNING</a>]<br>16:54:59.898 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:75] - Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableUsageCredentialCriteria for criteria class org.opensaml.xml.security.criteria.UsageCriteria<br>16:54:59.898 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:106] - Registry could not locate evaluable criteria for criteria class org.opensaml.security.MetadataCriteria<br>16:54:59.899 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:75] - Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableEntityIDCredentialCriteria for criteria class org.opensaml.xml.security.criteria.EntityIDCriteria<br>16:54:59.899 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:75] - Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableKeyAlgorithmCredentialCriteria for criteria class org.opensaml.xml.security.criteria.KeyAlgorithmCriteria<br>16:54:59.899 - DEBUG [org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:153] - Attempting to verify signature using trusted credentials<br>16:54:59.899 - DEBUG [org.opensaml.xml.security.SigningUtil:238] - Verifying signature over input using public key of type RSA and JCA algorithm ID SHA1withRSA<br>16:54:59.900 - DEBUG [org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:161] - Failed to verify signature using either supplied candidate credential or directly trusted credentials<br>16:54:59.900 - DEBUG [org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:170] - Candidate credential was either not supplied or did not contain verification key<br>16:54:59.900 - DEBUG [org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:171] - PKIX trust engine requires supplied key, skipping PKIX trust evaluation<br>16:54:59.900 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:194] - Simple signature validation (with no request-derived credentials) failed<br>16:54:59.901 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:137] - Validation of request simple signature failed for context issuer: <a href="https://sp.foobar.edu/shibboleth-sp">https://sp.foobar.edu/shibboleth-sp</a><br></div></div>